VA-003 Compare authentication methods Practice Test 5 — 15 Questions

Question 1

An administrator wants to allow human users to authenticate using their corporate Active Directory credentials. Which authentication method should they enable?

Accepted Answer

LDAP auth. LDAP (Lightweight Directory Access Protocol) authentication allows integration with corporate Active Directory by binding to the directory service using a user's credentials. This enables centralized authentication against existing AD user objects without duplicating accounts in the Vault system.

Answer

Token auth

Answer

GitHub auth

Answer

Userpass auth

Question 2

Which THREE are best practices when selecting authentication methods for different use cases?

Accepted Answer

Use AppRole for automated CI/CD pipelines.. Option A is correct because AppRole is purpose-built for machine-to-machine authentication: it issues a RoleID and SecretID that a CI/CD pipeline can deliver programmatically, and its response-wrapping and secret-ID lifecycle controls make it the recommended method for automated, non-interactive workloads. Option C is correct because AWS IAM auth lets an EC2 instance present its instance profile credentials to Vault, which verifies the AWS-signed request via STS, so no static Vault credentials need to be stored on the instance. Option E is correct because LDAP auth binds directly to a directory such as Active Directory, allowing human users to authenticate with their existing AD credentials and inherit group-based policies, which is the standard approach for enterprise human access. Option B is not a best practice because making token auth the sole method for everyone ignores stronger, purpose-specific methods and forces manual token distribution and lifecycle management, increasing leakage risk. Option D is not a best practice as stated because Kubernetes auth is only appropriate for pods running in a Kubernetes cluster that Vault is configured to trust; using it 'in any environment' is impossible where no Kubernetes service account token or Vault Kubernetes auth role exists.

Answer

Use token auth as the sole method for all users and machines.

Answer

Use Kubernetes auth for pods in any environment.

Question 3

A small company uses Vault with LDAP authentication for their employees. They configured the LDAP auth method pointing to their on-premises Active Directory. Several users report that they can log in to the Vault UI, but they cannot see any secrets in the paths they expect. The administrator verified that the users are in the correct AD groups. The Vault policies are defined and assigned to groups via the LDAP auth method's group mapping. However, the users still have no permissions. What is the most likely root cause and the correct fix?

Accepted Answer

The group mapping in Vault does not match the AD group names (case or syntax).. The most likely root cause is that the group mapping in Vault does not match the AD group names due to case sensitivity or syntax differences. Vault's LDAP auth method performs exact string matching when mapping LDAP groups to Vault policies; if the group names in the Vault configuration (e.g., 'Domain Admins') differ from the actual AD group names (e.g., 'Domain Admins' with a trailing space or different case), the mapping fails, resulting in no policy assignment and thus no permissions.

Answer

The LDAP bind credentials are incorrect.

Answer

The LDAP auth method is not enabled.

Answer

The Vault token's TTL is too short.

Question 4

A company runs its containerized workloads on multiple Kubernetes clusters and also maintains a number of legacy virtual machines running critical applications. The Vault cluster is deployed outside Kubernetes and is used to manage secrets for both environments. The DevOps team has configured the Kubernetes auth method for pods in the Kubernetes clusters, but they are experiencing authentication failures for pods in one specific namespace. Meanwhile, legacy VMs cannot authenticate at all because they are not part of any Kubernetes cluster. The Vault administrator needs to enable authentication for all workloads while minimizing changes to existing applications. The administrator has received the following requirements: containerized pods should authenticate without manual token distribution, legacy VMs should use a method that supports machine-oriented authentication with short-lived tokens, and all authentication should be auditable. Which course of action should the administrator take?

Accepted Answer

Keep the Kubernetes auth method for pods (fixing the namespace-specific issue) and enable AppRole authentication for the legacy VMs, using response wrapping or trusted entities for SecretID delivery.. It preserves the existing Kubernetes auth method for pods (after fixing the namespace-specific issue) and introduces AppRole for legacy VMs, which provides machine-oriented authentication with short-lived tokens via SecretIDs. This approach minimizes changes to existing applications, meets the requirement for auditable authentication (both methods log to Vault audit devices), and avoids manual token distribution by using response wrapping or trusted entities for secure SecretID delivery.

Answer

Configure the LDAP auth method for both pods and legacy VMs, creating service accounts in Active Directory for each application.

Answer

Configure the Kubernetes auth method on all clusters and also install a Vault sidecar on the legacy VMs to make them appear as pods.

Answer

Use AppRole as the sole authentication method for all workloads, generating secret IDs for each pod and VM.

Question 5

A platform team runs Vault in an on-premises data center. Their legacy monitoring appliance cannot present a TLS client certificate and has no cloud identity provider, but it does have a dedicated filesystem path where it can read a small configuration file written at deployment time. The team wants the appliance to authenticate on a schedule with credentials that can be issued per appliance, scoped by policy, and revoked without affecting other appliances. Which authentication method best fits this requirement?

Accepted Answer

AppRole. AppRole is the machine-oriented authentication method that issues each client a RoleID and a SecretID, both of which can be delivered through a file on the appliance. Roles are bound to policies, and SecretIDs can be revoked individually, allowing the platform team to isolate and revoke a single appliance without impacting others. The other methods require capabilities the appliance does not have.

Answer

JWT/OIDC

Answer

TLS Certificates

Answer

Username & Password

Question 6

A platform team operates Vault in a hybrid cloud. They want a single authentication method that lets employees use their existing cloud provider identity (e.g., AWS IAM role, Azure managed identity) to log in without distributing Vault-specific credentials. Which authentication method should they enable?

Accepted Answer

Cloud auth method (e.g., AWS, Azure, GCP). Cloud auth methods (AWS, Azure, GCP) enable authentication using existing cloud provider identities. For AWS, Vault uses the IAM principal's signed request to verify identity; for Azure, it validates managed identity tokens. This eliminates the need to distribute Vault-specific credentials and aligns with the hybrid cloud requirement.

Answer

GitHub auth method

Answer

Username & Password auth method

Answer

Cloud Foundry auth method

Question 7

A Vault operator needs to let an on-premises LDAP directory's groups map directly to Vault policies, but the directory does not implement any OIDC or SAML endpoints. Which auth method should the operator enable to authenticate users against that directory?

Accepted Answer

LDAP auth method. The LDAP auth method is designed to authenticate against an LDAP directory using standard bind operations and can map directory groups to Vault policies. Because the directory lacks OIDC or SAML capabilities, methods built on those protocols cannot be used, and a cloud-specific method like GitHub auth is unrelated to the on-premises directory.

Answer

GitHub auth method

Answer

SAML auth method

Answer

OIDC auth method

Question 8

A developer needs to authenticate to Vault from a CI/CD pipeline running on an on-premises server. The pipeline cannot use cloud provider identities or Kubernetes. The security team wants to avoid embedding long-lived Vault tokens in the pipeline scripts. Which authentication method is most appropriate?

Accepted Answer

AppRole auth method. AppRole is purpose-built for machine-to-machine authentication, including CI/CD pipelines. It uses a role_id and secret_id that can be delivered securely and have short TTLs, avoiding long-lived tokens. Other methods either require interactive user flows or static credentials unsuitable for the scenario.

Answer

Username & Password auth method

Answer

GitHub auth method

Answer

OIDC auth method

Question 9

A platform team wants Kubernetes pods to authenticate to Vault by presenting their service account token, with Vault verifying the token's validity against the Kubernetes API and checking the pod's namespace and service account name. Which auth method should the team enable?

Accepted Answer

Kubernetes auth method. The Kubernetes auth method is purpose-built for this case: it validates the service account JWT through the Kubernetes TokenReview API and enforces role constraints such as namespace and service account name. Generic JWT auth cannot perform the Kubernetes-specific token review, and methods like AppRole or cert auth rely on entirely different credentials.

Answer

JWT auth method

Answer

AppRole auth method

Answer

Cert auth method

Question 10

A developer wants to log in to Vault from a terminal by supplying a username and password that Vault stores and manages internally, without relying on any external identity system. Which auth method should be enabled?

Accepted Answer

Userpass auth method. Userpass keeps user records and password hashes within Vault, so it delivers exactly the self-contained username and password login described. LDAP and OIDC both depend on external systems, and token auth only consumes a pre-existing token rather than authenticating a user with credentials.

Answer

Token auth method

Answer

OIDC auth method

Answer

LDAP auth method

Question 11

An administrator is configuring Vault to allow employees to log in using their existing corporate credentials managed by an external identity provider that supports OIDC. The administrator wants to avoid creating local Vault users. Which authentication method should be used?

Accepted Answer

OIDC auth method. OIDC auth method enables authentication via an external OIDC identity provider, allowing employees to use corporate credentials without local Vault users. It supports standard OIDC flows and JWT validation, making it the right choice for integrating with an OIDC-capable IdP.

Answer

Okta auth method

Answer

LDAP auth method

Answer

Username & Password auth method

Question 12

A company's CI system runs outside any cloud provider and must authenticate to Vault without embedding a long-lived secret in its build scripts. The security team wants the CI job to prove its identity using a credential that Vault validates against the CI platform itself. Which auth method best fits this requirement?

Accepted Answer

JWT/OIDC auth method. JWT/OIDC auth is the right fit because the CI platform can mint a short-lived signed JWT that Vault validates against the platform's keys, proving the job's identity without a stored static secret. Userpass and token auth both require long-lived credentials, and cert auth relies on a stored client certificate rather than a platform-issued token.

Answer

Token auth method

Answer

Cert auth method

Answer

Userpass auth method

Question 13

A platform team runs Vault in a hybrid cloud and wants to let engineers log in with their existing corporate identities held in Okta, without creating separate Vault usernames or passwords. The Okta tenant supports OpenID Connect and exposes a discovery document. Which authentication method should they enable to meet this requirement with the least administrative overhead?

Accepted Answer

Enable the OIDC auth method and configure it with the Okta discovery URL and a client ID/secret registered in Okta.. Federated login against an OIDC-capable identity provider is served by Vault's OIDC auth method, which consumes the provider's discovery document and validates ID tokens. The other methods either require a static bind credential, depend on an unrelated identity source, or duplicate credentials inside Vault, none of which satisfies least-overhead federation with Okta.

Answer

Enable the Username & Password auth method and synchronize Okta user records into Vault on a schedule.

Answer

Enable the GitHub auth method and map Okta users by their GitHub organization membership.

Answer

Enable the LDAP auth method and bind Vault to the Okta LDAP interface using a service account.

Question 14

A platform team manages a fleet of on-premises Linux servers that are not joined to any cloud provider or Active Directory domain. They want each server to authenticate to Vault automatically at boot without embedding a long-lived token in a configuration file. The team already maintains an internal PKI that issues X.509 certificates to every server. Which authentication method should they enable to meet these requirements with the least new infrastructure?

Accepted Answer

Enable the cert auth method and configure a trusted CA certificate so each server presents its PKI-issued certificate during login.. Certificate authentication leverages the PKI certificates the servers already possess, so no new credential distribution channel is needed. During the TLS handshake the server presents its certificate, and Vault validates it against the trusted CA configured on the cert mount. This yields automatic, secret-free login for on-premises hosts that have no cloud identity.

Answer

Enable the aws auth method and bind each server to an IAM role so it can call STS GetCallerIdentity during login.

Answer

Enable the approle auth method and distribute a role_id and secret_id to each server's configuration file.

Answer

Enable the ldap auth method and point it at the internal directory where each server has a service account.

Question 15

A security engineer is comparing the AppRole and Kubernetes auth methods for a containerized application. The application runs in a Kubernetes cluster and needs to authenticate to Vault. The engineer wants to minimize the risk of secret leakage and avoid manual secret rotation. Which statement best describes the advantage of Kubernetes auth over AppRole in this scenario?

Accepted Answer

Kubernetes auth uses a service account token that is automatically mounted and rotated by Kubernetes, eliminating the need to store a static secret_id.. Kubernetes auth uses the pod's service account token, which Kubernetes automatically mounts and rotates. This removes the need to store a static secret_id, reducing leakage risk and manual rotation. AppRole requires a secret_id that must be protected and rotated, making Kubernetes auth advantageous in this containerized scenario.

Answer

Kubernetes auth automatically rotates the Vault token every 24 hours without any configuration.

Answer

AppRole is always more secure because it supports CIDR binding, while Kubernetes auth does not.

Answer

Kubernetes auth requires a secret_id that is stored in a Kubernetes Secret and manually rotated.